Privacy Policy

1. Data we collect

• Account data: name, email address, password (stored only as a secure hash), profile picture, language preference and, if you sign in with Google or GitHub, the basic profile information those providers share with us.
• Content data: prompts, messages, files, images, videos, documents, websites and other content you upload or generate, plus the settings of tools you use.
• Connected-account data: if you connect third-party services (for example social networks, email or GitHub), the access tokens and the data needed to perform the actions you request.
• Usage and device data: log data such as IP address, browser and device type, pages and features used, usage counts against your plan, error reports and approximate location derived from your IP address.
• Billing data: your plan, transaction history and billing country. Payments are processed by Paddle.com, our Merchant of Record. We do not receive or store your full card or bank details.
• Communications: messages you send to support, feedback, reports and survey responses.

1.1 Facebook and Instagram connections

If you choose to connect a Facebook Page or an Instagram professional account, you sign in with Meta and select the permissions to share. Ditfa stores the access credentials returned by Meta in encrypted form; the connection does not require you to give Ditfa your Facebook or Instagram password.

Depending on the permissions you grant and the features you use, this data can include account and Page identifiers, names, profile pictures, posts and media, messages and comments, and engagement or account metrics. We use it to show your connected accounts, provide your inbox and analytics, publish the content you approve, and carry out the reply or automation rules you enable. If you enable AI-assisted replies, relevant conversation content is processed to generate those replies as described in the service-provider section below.

For the built-in Facebook and Instagram AI replies and inbox classification, the AI-agent settings show the configured data recipients and their declared processing countries. If no eligible model is available, AI replies hand over to a person and classification uses local rules. Connecting a model for ordinary chat does not automatically make it eligible to receive connected-account data.

If you connect your own AI service for ordinary chat, the content needed for your request is sent to the endpoint you configure. Review that service’s privacy notice, retention practices and processing locations before using it. Its terms and your settings govern its handling of that content; choosing a model brand does not by itself identify every API operator or intermediary.

1.2 Disconnecting Meta accounts and requesting deletion

You can disconnect a Facebook Page or Instagram account in Marketing → Accounts. Disconnecting stops Ditfa from using that connection for further activity; it does not by itself delete information already stored in Ditfa.

To request deletion of data received through a Meta connection, email foshatidev@gmail.com and identify the Ditfa account and connected Page or Instagram account concerned. Do not send passwords or access tokens. You can also use Meta’s data-deletion request process where it is offered for the connected app.

When Meta sends Ditfa a valid data-deletion request, Ditfa removes the associated stored Meta credentials and the Marketing records received through the affected connections. The response provides a confirmation code and a link to the deletion status page, where you can check that request. Information you created independently in Ditfa is handled separately under this policy.

2. How we use your data and our legal bases

• To provide the Service (performance of our contract with you): create and manage your account, run the AI features you request, store your content, process subscriptions and provide support.
• To keep the Service safe (legitimate interests and legal obligations): prevent fraud and abuse, enforce our Acceptable Use Policy, moderate content and secure our systems.
• To improve the Service (legitimate interests): analyse aggregated usage, fix bugs and develop features. We do not use the content of your private files or conversations to train our own foundation models. External AI services handle content under their applicable terms and settings, as described below.
• To communicate with you (contract and legitimate interests): send service, security and billing notices and, where you have agreed or the law allows, product news. You can unsubscribe from marketing email at any time.
• To comply with law (legal obligation): respond to lawful requests, keep tax and accounting records and meet regulatory duties.

3. AI providers and other service providers

We share personal data as needed to run the Service, including with service providers and external services you choose to connect:

• AI model and API operators that process the prompts, files and context needed to return a result. Providers configured by Ditfa and providers you connect yourself may have different terms, retention practices and processing locations. The declared recipients for built-in Meta AI features are shown in the AI-agent settings.
• Cloud hosting, storage, database and content-delivery providers.
• Email delivery, customer support and error-monitoring tools.
• Google Analytics (Google), when you allow optional analytics on our website or web app. It measures public-page visits, app sections and selected actions such as successful email or phone registration and opening a tool. We use a first-party analytics cookie to understand a browser’s journey between ditfa.com and chat.ditfa.com. The integration does not send form values, account identifiers, conversation content, file names, private resource identifiers or URL query strings. Advertising personalization and Google signals are disabled. The website and web app each ask for your choice. You can withdraw it through Analytics settings in the website footer or the web app’s Account settings → Settings → Data.
• Paddle.com, which processes payments, taxes, invoicing and refunds as Merchant of Record and handles your payment details under its own privacy notice.

We also share data when you ask us to (for example when you publish a page or post to a connected social account), when required by law or to protect rights and safety, and with a successor in a merger or acquisition. We do not sell your personal data and we do not share it for cross-context behavioural advertising.

A list of our current sub-processors is available on request from foshatidev@gmail.com.

4. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, remember your language and protect against fraud. We may also use analytics cookies or similar technologies to understand how the Service is used. Where the law requires consent for non-essential cookies, we ask for it first, and you can change your choice at any time. You can also block or delete cookies in your browser settings; some features may not work without necessary cookies.

5. Data retention

• Account data and content are kept while your account is active.
• When you delete content, it is removed from active systems promptly and from backups within 30 days.
• When you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep it longer for legal, tax, fraud-prevention or dispute purposes.
• Logs and security records are kept for a limited period, normally no more than 12 months.

6. Your rights

Depending on where you live (including under the EU and UK GDPR and US state privacy laws such as the CCPA/CPRA), you may have the right to:

• access the personal data we hold about you and receive a copy;
• export your data in a portable format;
• correct inaccurate data;
• delete your data and your account;
• object to or restrict certain processing, including direct marketing;
• withdraw consent at any time where processing is based on consent;
• not be discriminated against for exercising your rights; and
• lodge a complaint with your local data-protection authority.

You can manage most of your data from your account settings. For any other request, email foshatidev@gmail.com. We will verify your identity and respond within 30 days (or the shorter period required by law). You may use an authorised agent where the law allows.

7. International transfers

We are based in the Sultanate of Oman and our service providers operate in several countries, including the United States and the European Union. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent UK mechanisms.

8. Children

The Service is not directed to children. You must be at least 13 years old to use it, or at least 16 in the European Economic Area, the United Kingdom and Switzerland. We do not knowingly collect personal data from children below these ages. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, access controls, monitoring and regular backups. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as required by law.

10. Changes to this policy

We may update this Privacy Policy. If changes are material, we will notify you by email or in the app before they take effect. The "Last updated" date at the top shows when it was last revised.

11. Contact

• Data controller: Premium Diamond for Business SPC, trading as Ditfa
• Registered address (as recorded on the CR): Bousher, Muscat Governorate, Postal Code 133, Sultanate of Oman
• Privacy requests: foshatidev@gmail.com
• General support: foshatidev@gmail.com

12. Ditfa for Chrome (browser extension)

Ditfa for Chrome is an AI assistant in your browser’s side panel. It reads a task’s current page and performs the steps you request. Page snapshots are taken only while you run or resume a task, on sites you have allowed. The site-access bar also uses the active tab’s URL and title to show which site you are on.

• Page data and purpose: a limited snapshot includes the page’s URL, title, visible text, scroll position and interactive elements (such as links, buttons and form fields, including non-sensitive values). Your instructions, replies and recent task steps accompany it to Ditfa’s API at chat.ditfa.com/api/browser-agent/step. The API sends this context to the configured AI model provider to choose the next step. Successful AI steps count against your account’s shared AI quota.
• Sensitive data: password, payment-card, bank-account, one-time-code and secret field values are replaced with a redaction marker before transmission; hidden inputs are skipped. Detected card numbers are removed from page text and ordinary field values. The extension does not collect passwords or card numbers from these protected fields, read or export websites’ cookies, or collect browsing history beyond the pages and steps needed for your task. Do not include secrets in your instructions or ordinary page text: automatic detection cannot identify every sensitive detail.
• Access levels: “Ask before every step” requires approval for interactions and page changes, while reading, scrolling, waiting and extraction can proceed. “Ask for sensitive steps” is the default and asks before detected sensitive actions, including sending, paying, deleting, downloading, submitting forms and changing account access. “Full access” skips action-approval cards after a warning and confirmation; you may also choose to allow all sites. Even with Full access, password/card/code entry and CAPTCHA checks remain your turn: complete them on the page and select “Done, continue”.
• Sign-in and local storage: the browser may attach your normal Ditfa session cookie to Ditfa API requests; its value is not read by the extension or included in page snapshots. Where needed, a session-bound extension token valid for up to 12 hours is kept in browser session memory. Panel history stays in session storage until you reset the task or close the browser; account display data stays until refreshed or the browser closes; the access-level preference is stored locally across restarts. These stores are not synced by the extension.
• Processing and retention: the step endpoint uses page snapshots to answer the current AI request and does not save them as chat conversations. It records account/model usage for quota accounting. AI-provider processing and service logs are covered by the provider and retention sections above; we do not promise that all processor records disappear when a task ends. We do not sell extension data, use it for unrelated advertising or creditworthiness decisions, or use private task content to train foundation models.
• Your controls: press Stop in the panel or on the page to end the task. Revoke a site with the site-access toggle; if you granted all sites, remove that broader permission in the browser’s extension site-access settings. Reset the task to clear panel history. Disconnect clears the extension token; to end cookie-based access, sign out of Ditfa on the web or revoke the web session in your account settings. You can remove the extension at any time. Revoking access stops future access; data already processed remains subject to the retention and rights sections above.